Cybersecurity

Houston, We Have A Wolf (And He's Driving The Spacecraft Now)

NeglectedSheep

• 2 min read
Share
Houston, We Have A Wolf (And He's Driving The Spacecraft Now)

Oh good. Oh, that's just wonderful.

I've had three cups of coffee, zero meaningful sleep, and a ticket queue that looks like a field after a stampede. And now I have to tell you that unauthenticated wolves can apparently just... walk up to NASA's spacecraft command interface and start pressing buttons. No credentials. No handshake. Nothing. Just vibes and arbitrary commands to a literal spacecraft.

I need a minute.

Cycode researchers dug up a chain of flaws in AIT-GUI, which is the browser-based operator console for NASA/JPL's AMMOS Instrument Toolkit. The vulnerability chain scored a 9.4 on CVSS v3.1, which in sheep terms means the hole in the fence isn't just big, it's load-bearing. The fence IS the hole now.

The short version: an unauthenticated coyote can reach the software's command bus and issue arbitrary commands to spacecraft and instruments. From a browser. Without logging in.

I'm going to go lie down in a field and think about my choices.

Look, I get it. Open-source toolkits accumulate technical debt like the flock accumulates ticks. Nobody's patching the spacecraft ground software because the Shepherds are busy asking why the dashboard isn't prettier. Classic. Meanwhile the electric fence around the command interface is apparently made of good intentions and cached hopes.

The tracking ID is GHSA-p9r8-2q67-fp86, in case you want to stare at it the way I'm staring at my ceiling at 2am. CVSS 9.4. Nine point four. For a thing that talks to spacecraft.

I'm not even mad. I'm just tired.

Remediation (Yes, Fine, Here)

If you are running AIT-GUI in any environment that matters:

  • Check the Cycode advisory and apply all available patches immediately. Shearing is not optional when the ticks are this big.
  • Enforce authentication at every layer touching the command bus. "Unauthenticated access to spacecraft commands" should not be a sentence that exists.
  • Isolate this interface from any public-facing network. Stick it behind the sheep tunnel at minimum.
  • Audit your command bus logs for anything that looks like a wolf poking around uninvited.
  • If you are a Shepherd who has been ignoring ground system security because it "isn't customer-facing," please come see me. I have a ticket for you.

The good news is this was responsibly disclosed and NASA has been notified. The bad news is I'm now thinking about every other open-source mission-critical tool running on a server somewhere with the electric fence unplugged.

Going back to my coffee. It's cold. Everything is fine.

Original Report: https://thehackernews.com/2026/08/nasa-ait-gui-flaws-could-let.html